CVE-2026-42618: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-42618 is a heap-based buffer overflow vulnerability in the ntfs_decompress() function within compress.c of NTFS-3G, a widely used open-source NTFS driver. It allows a local attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image, potentially enabling privilege escalation to root. All versions of NTFS-3G through 2026.2.25 are affected; the vulnerability was fixed in version 2026.7.7, released July 15, 2026. It was publicly disclosed on October 7, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a single-byte heap buffer overflow (CWE-122, CWE-193 off-by-one error, CWE-787 out-of-bounds write) in the ntfs_decompress() function in compress.c. The overflow is triggered when the NTFS-3G binary processes a specially crafted compressed file within a malicious NTFS image — an attacker with local access mounts or reads from such an image, causing the decompression routine to write one byte beyond the allocated heap buffer. Because ntfs-3g runs as a SUID-root binary, this heap corruption occurs in a privileged process context, making it exploitable for privilege escalation. The vulnerability was discovered and reported by Alexandro Calo' from Nozomi Networks Labs (referenced as Nozomi Labs NN-2026-0076), along with Abhishek Kumar and Jurre van Bergen (GitHub Advisory).

Successful exploitation allows a local user with standard (low) privileges to corrupt heap memory in the privileged ntfs-3g process, potentially achieving arbitrary code execution with root privileges — a full privilege escalation. The integrity and availability of the affected system are at high risk, while confidentiality impact is rated none in the CVSS v3.1 assessment (though root-level code execution inherently enables data access). The attack does not require user interaction or elevated starting privileges, making it a significant local privilege escalation risk on any Linux or Unix system running a vulnerable NTFS-3G version (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.00126 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attribution is to security researchers at Nozomi Networks Labs, with no known threat actor weaponization.

1. Prepare a malicious NTFS image: Craft a specially constructed NTFS filesystem image containing a compressed file with malformed compression data designed to trigger the off-by-one overflow in ntfs_decompress() in compress.c.
2. Deliver the image to the target: Place the malicious NTFS image on a medium accessible to the target system (e.g., USB drive, network share, or a file the local user can access).
3. Trigger mounting or file read: As a low-privileged local user, cause the SUID-root ntfs-3g binary to process the malicious image — for example, by mounting the image (ntfs-3g /dev/sdX /mnt/point) or using a tool that reads from it, triggering the decompression of the crafted file.
4. Heap corruption occurs: The ntfs_decompress() function writes one byte beyond the allocated heap buffer in the privileged ntfs-3g process, corrupting adjacent heap metadata or data.
5. Achieve privilege escalation: By carefully controlling heap layout (heap grooming), an attacker can leverage the single-byte overflow to redirect execution flow or overwrite security-sensitive data, ultimately achieving code execution as root (GitHub Advisory, Red Hat Bugzilla).

• Process: Unexpected child processes (e.g., /bin/bash, sh, python) spawned by the ntfs-3g process with root privileges; ntfs-3g processes crashing with segmentation faults or heap corruption errors in system logs.
• Logs: System logs (/var/log/syslog, /var/log/kern.log) showing ntfs-3g crashes, SIGSEGV or SIGABRT signals, or glibc heap corruption messages (e.g., malloc(): corrupted top size) associated with ntfs-3g.
• File System: Unexpected NTFS image files (.img, .iso, .ntfs) in user-accessible directories; new SUID binaries or modified /etc/passwd//etc/shadow files following ntfs-3g execution.
• Network: Outbound connections from the system shortly after ntfs-3g execution, potentially indicating a reverse shell established after privilege escalation.

Update NTFS-3G to version 2026.7.7 or later, which includes the fix for CVE-2026-42618 along with several other security patches released on July 15, 2026. Patches are also available for the older 2022.10.3 branch (ntfs-3g_2022.10.3-cve_2026-04_1.patch). No effective workaround exists other than disallowing NTFS volumes with compressed files from being used with ntfs-3g (which is difficult to enforce in practice); alternatively, restrict access to the ntfs-3g binary for unprivileged users or disable NTFS-3G entirely if not required. Linux distributions including Ubuntu (USN-8554-1), SUSE (SUSE-SU-2026:3213-1), Debian, and Gentoo have issued updated packages (GitHub Advisory, NTFS-3G Releases).

The vulnerability was credited to researchers from Nozomi Networks Labs (Alexandro Calo'), Abhishek Kumar, and Jurre van Bergen, and was part of a broader batch of security fixes in the NTFS-3G 2026.7.7 security release that addressed nine CVEs simultaneously. Multiple Linux distributions (Ubuntu, SUSE, Debian, Gentoo, Mageia) issued security advisories and updated packages promptly after disclosure. The vulnerability was also noted in the context of Microsoft's October 2026 Patch Tuesday coverage, reflecting its cross-platform relevance given NTFS-3G's use in Linux environments that interact with Windows filesystems (GitHub Advisory, BleepingComputer).